Secure Future Tech Solutions | IT Support & Services based in Warwick, RI | 110 Jefferson Boulevard, Suite C, Warwick, Rhode Island 02888 | 401-267-4635https://www.securefuturetech.com
Tue, 18 Dec 2018 17:59:50 +0000en-UShourly1https://wordpress.org/?v=4.7.11Dell May Have Been Hacked So User Passwords Are Resetting https://www.securefuturetech.com/2018/12/18/dell-may-have-been-hacked-so-user-passwords-are-resetting/
https://www.securefuturetech.com/2018/12/18/dell-may-have-been-hacked-so-user-passwords-are-resetting/#respondTue, 18 Dec 2018 16:00:00 +0000https://www.securefuturetech.com/2018/12/18/dell-may-have-been-hacked-so-user-passwords-are-resetting/Have you ever created an account on Dell's website to purchase computer equipment? If so, your account may have been compromised. As a precaution, Dell has forced password resets for every account ...]]>Have you ever created an account on Dell's website to purchase computer equipment? If so, your account may have been compromised. As a precaution, Dell has forced password resets for every account on their site. You've likely already got a notification sitting in your inbox with a password rest link and additional instructions and information.

The company detected the intrusion on November 9th and identified it as an attempt to steal a wide range of customer information, including customer names, email addresses and passwords.

During the subsequent investigation into the attempt, the company found no conclusive evidence that the network was successfully breached, or that any information was compromised. Out of an abundance of caution, they took the step of force-resetting all passwords on the system.

The company stressed that no credit card data or other sensitive information was at risk and that the incident did not impact any of Dell's products or services; only the web portal itself. At this point, the investigation is still ongoing, and the company has not provided any further information. As the investigation winds down, we may get a final report from them about the matter.

If you have an account on Dell's website, be sure to check the email address you have on the account and reset your password at your next opportunity, just to be safe.

It should go without saying, but unfortunately, recent data indicates that a shocking percentage of people are still using the same password across multiple web properties. If you're one of the legions of people still doing that, now would be an excellent time to rethink that strategy.

While there's no solid indication that any information was stolen, it's always a possibility. If you've recycled your Dell password and used it on other sites, you may be exposing yourself to tremendous risk and damage that could take months, if not years to recover from.

]]>https://www.securefuturetech.com/2018/12/18/dell-may-have-been-hacked-so-user-passwords-are-resetting/feed/0Windows 10 Will Notify Users When Apps Use Their Microphonehttps://www.securefuturetech.com/2018/12/17/windows-10-will-notify-users-when-apps-use-their-microphone/
https://www.securefuturetech.com/2018/12/17/windows-10-will-notify-users-when-apps-use-their-microphone/#respondMon, 17 Dec 2018 16:00:00 +0000https://www.securefuturetech.com/2018/12/17/windows-10-will-notify-users-when-apps-use-their-microphone/In recent months, security researchers have unearthed all sorts of new hardware vulnerabilities. Several of them allow hackers to quietly assume control of your PC's built-in camera or microphone, giving them the ...]]>In recent months, security researchers have unearthed all sorts of new hardware vulnerabilities. Several of them allow hackers to quietly assume control of your PC's built-in camera or microphone, giving them the ability to spy on you and invade your privacy at will.

Normally this is accomplished when a hacker can trick you into downloading what you believe to be a legitimate application, but it secretly contains malicious code allowing the hacker to take control of those functions without your knowledge.

Recently, Microsoft added a new feature to their OS that will give you a visual cue any time your mic is being accessed by an app running on your system. Unfortunately, the new upgrade isn't available to the general public yet, If you'd like a sneak peek, you can get it by enrolling your machine in the Windows Insider program and downloading the 19H1 Fast Ring build, 18290.

It works like this:

Any time an application is using your mic, you'll see a small colored dot on the microphone icon on the taskbar.

When you hover your mouse over the new microphone icon in the taskbar, you'll get a list of which, if any apps are currently recording. Double clicking on the icon will take you to the Microsoft Privacy Settings page.

The company warns that this beta version of the OS is still unstable. If you opt to go down that road, be aware that you might see some unusual and unexpected behavior, but it will give you an opportunity to experiment with new features well before others.

According to a Microsoft spokesman, "If multiple apps are using your microphone, then it will just list how many are actively using your microphone. We still have a bit more to do, stay tuned!"

There has been no official word from the company on when the new feature will be finalized, or when it will be rolled out to the public, but typically, Windows 10 receives updates twice a year. It's a simple, valuable addition we're looking forward to.

]]>https://www.securefuturetech.com/2018/12/17/windows-10-will-notify-users-when-apps-use-their-microphone/feed/0Microsoft Is Bringing Augmented Reality To The Military https://www.securefuturetech.com/2018/12/15/microsoft-is-bringing-augmented-reality-to-the-military/
https://www.securefuturetech.com/2018/12/15/microsoft-is-bringing-augmented-reality-to-the-military/#respondSat, 15 Dec 2018 16:00:00 +0000https://www.securefuturetech.com/2018/12/15/microsoft-is-bringing-augmented-reality-to-the-military/Microsoft just won a huge military contract worth $480 million to bring 100,000 customized AR (Augmented Reality) headsets, based on their HoloLens technology, to the US Army. The army's plan is to ...]]>Microsoft just won a huge military contract worth $480 million to bring 100,000 customized AR (Augmented Reality) headsets, based on their HoloLens technology, to the US Army.

The army's plan is to integrate the headsets with their STES (Synthetic Training Environment Squad) system, which allows US forces to conduct hyper-realistic mock battles as practice before a live firefight, with an emphasis on improving close-combat capabilities, especially in subterranean and urban environments.

A spokesman for the Army had this to say:

"Soldier lethality will be vastly improved through cognitive training and advanced sensors, enabling squads to be first to detect, decide and engage. Accelerated development of these capabilities is necessary to recover and maintain over match."

A spokesman for Microsoft added:

"Augmented-reality technology will provide troops with more and better information to make decisions. This new work extends our longstanding, trusted relationship with the Department of Defense to this new area."

Obviously, the Army's version of the HoloLense headsets will be quite different from the consumer variants currently available. The Army will have wireless connectivity built in, and hooks that would allow other military gear like night vision goggles and sensors that provide real-time metrics on soldier performance. These metrics include basic health stats like heart rate, respiration rate to be fed into the HoloLens display.

Now that the ink is dry on this deal, the military is Microsoft's largest HoloLens customer, which isn't necessarily a bad thing. Already there's a long and growing wish list of new capabilities the army needs to make the headsets even more useful, some of which will eventually (and inevitably) filter back into the commercial market.

For one thing, the army is very interested in getting the overall weight of the headset down. Currently, the HoloLens headset weighs upwards of fifteen pounds. The army's goal is to see it reduced to just one pound.

A daunting challenge, like the rest of the items on the army's wish list, but these things will no doubt help push the technology forward.

]]>https://www.securefuturetech.com/2018/12/15/microsoft-is-bringing-augmented-reality-to-the-military/feed/0Hackers Are Exploiting Home And Small Office Routers https://www.securefuturetech.com/2018/12/14/hackers-are-exploiting-home-and-small-office-routers/
https://www.securefuturetech.com/2018/12/14/hackers-are-exploiting-home-and-small-office-routers/#respondFri, 14 Dec 2018 20:00:00 +0000https://www.securefuturetech.com/2018/12/14/hackers-are-exploiting-home-and-small-office-routers/Akamai has discovered a nasty new hack that's allowing cybercriminals to move beyond simply compromising routers, but also, in some instances, to use the compromised routers to take control of other machines ...]]>Akamai has discovered a nasty new hack that's allowing cybercriminals to move beyond simply compromising routers, but also, in some instances, to use the compromised routers to take control of other machines sitting behind it on your network.

The hack, known as UPnProxy exploits weaknesses in the design of the UPnP services installed on many routers, allowing hackers to alter the router's Network Address Translation tables.

These tables are essentially a set of codified rules that control how ports and IPs from the router's internal network are mapped out onto a larger network segment, most commonly, the internet itself.

When the exploit was first discovered back in April, it was being used to slave routers, converting them into proxies for regular web traffic. However, according to Akamai, there's a new variant of the UPNProxy attack that allows hackers to insert their own rules into the NAT tables of routers.

In addition to slaving the router as described above, the new rules allow a hacker outside your network to connect to the SMB ports of computers and other devices located behind the router, inside your company's network.

According to Asamai's estimates, there are some 277,000 routers that have UPnP services exposed online that are vulnerable to the exploit. More than 45,000 of these have already been modified in the most recent campaign discovered by the company.

A spokesman for Akamai had this to say about their recent discovery:

"Recent scans suggest that these attackers are being opportunistic. The goal here isn't a targeted attack. It's an attempt at leveraging tried and true off the shelf exploits, casting a wide net into a relatively small pond, in the hopes of scooping up a pool of previously inaccessible devices."

Fortunately, as part of the White Paper Akamai published about the attack, they also included instructions for how to remove malicious NAT table entries from impacted routers. It's well worth the read.

]]>https://www.securefuturetech.com/2018/12/14/hackers-are-exploiting-home-and-small-office-routers/feed/0Data On Millions Of Americans Leaked Through Open Server https://www.securefuturetech.com/2018/12/13/data-on-millions-of-americans-leaked-through-open-server/
https://www.securefuturetech.com/2018/12/13/data-on-millions-of-americans-leaked-through-open-server/#respondThu, 13 Dec 2018 16:00:00 +0000https://www.securefuturetech.com/2018/12/13/data-on-millions-of-americans-leaked-through-open-server/Bob Diachenko, the Director of Cyber Risk Research for Hacken, recently made a disturbing discovery. He found an ElasticSearch server open and vulnerable on the internet, without so much as a password ...]]>Bob Diachenko, the Director of Cyber Risk Research for Hacken, recently made a disturbing discovery. He found an ElasticSearch server open and vulnerable on the internet, without so much as a password to protect it.

Unfortunately, the server was leaking a staggering 73GB of data and had a number of databases cached inside the server's memory. In one of those databases, Diachenko discovered more than 56 million records containing personally identifiable information belonging to US citizens around the country.

In the majority of cases, the exposed information was limited to:

Full name

Email address

Street address (including Zip Code)

Phone number or numbers

IP addresses

Sadly, to an even moderately talented hacker, that's more than enough information to fake someone's identity. That means the data has real value on the Dark Web and may be being sold off as you read these words.

Another of the databases contained nearly twenty-six million records containing business information.

In this case, the exposed information included:

Company name and brief description

Zip codes and carrier routes

Latitude and longitude coordinates

Census tracts

Website addresses

Email addresses

Employee headcounts

Revenue numbers

Phone numbers

SIC codes

NAICS codes

And the like

Diachenko made the discovery on November 20th, but upon further research discovered that it had actually been indexed by Shoddan on November 14th. He was not able to determine who owned the exposed server, but based on a few breadcrumbs he did find, he concluded that it's likely owned by the Canadian data firm "Data and Leads," or that the company is at least indirectly connected to the server somehow.

The firm did not respond to inquiries made by Diachenko, or later, by ZDNet. Shortly after those requests for comment were made, the company's website mysteriously went down.

The apparent cause of this breach is the same thing that's caused other recent ElasticSearch breaches. In a shocking number of cases, admins don't bother to set up passwords for their servers, which they later leave exposed on the internet. An easy problem to fix, but it begs the question: Are your servers password protected?

]]>https://www.securefuturetech.com/2018/12/13/data-on-millions-of-americans-leaked-through-open-server/feed/0USPS Vulnerability May Have Exposed Millions of Usershttps://www.securefuturetech.com/2018/12/12/usps-vulnerability-may-have-exposed-millions-of-users/
https://www.securefuturetech.com/2018/12/12/usps-vulnerability-may-have-exposed-millions-of-users/#respondWed, 12 Dec 2018 16:00:00 +0000https://www.securefuturetech.com/2018/12/12/usps-vulnerability-may-have-exposed-millions-of-users/Do you have an account on USPS.com? If so, you're not alone. Tens of millions of Americans use it daily for a variety of purposes. Unfortunately, if you do have an account, ...]]>Do you have an account on USPS.com? If so, you're not alone. Tens of millions of Americans use it daily for a variety of purposes. Unfortunately, if you do have an account, it may have been compromised.

Recently, the USPS announced the discovery of a critical security vulnerability that exposed the account information of more than sixty million customers to literally anyone with a USPS.com account.

The flaw was discovered by a researcher who has chosen to keep his/her identity a secret, but essentially worked like this:

Any user logged into USPS.com could perform a search using any number of wildcard search parameters. Given that, any user could search for the details of literally any other user on the system and get them. Note that nearly any detail could be collected in this manner, including:

User name

Email address

Mailing address

Phone number

Authorized users

And more

Worst of all, the process of obtaining all the data could easily be automated and simply left to run and collect.

Setu Kulkarni, the VP of Strategy and Business Development at WhiteHat Security had this to say about the flaw:

"APIs are turning out to be a double-edged sword when it comes to internet scale B2B connectivity and security. APIs, when insecure, break down the very premise of uber connectivity they have helped establish.

To avoid similar flaws, government agencies and companies must be proactive, not just reactive, in regard to application security. Every business that handles consumer data needs to make security a consistent, top-of-mind concern with an obligation to perform the strictest security tests against vulnerable avenues: APIs, network connections, mobile apps, websites, and databases. Organizations that rely on digital platforms need to educate and empower developers to code using security best practices through the entire software lifecycle, with proper security training and certifications."

The worst part about this incident was the fact that the unnamed security researcher reported the issue to the post office over a year ago. It took that long for the agency to finally take action, and when they did, they were able to solve the problem in less than 48 hours.

While it's unknown if anyone took advantage of the flaw, there's no sense taking chances. Assume the worst and act accordingly.

]]>https://www.securefuturetech.com/2018/12/12/usps-vulnerability-may-have-exposed-millions-of-users/feed/0Uber Gets Hefty Fine From The EU For Data Breach https://www.securefuturetech.com/2018/12/11/uber-gets-hefty-fine-from-the-eu-for-data-breach/
https://www.securefuturetech.com/2018/12/11/uber-gets-hefty-fine-from-the-eu-for-data-breach/#respondTue, 11 Dec 2018 16:00:00 +0000https://www.securefuturetech.com/2018/12/11/uber-gets-hefty-fine-from-the-eu-for-data-breach/In recent years we've seen several companies suffer from hacks of various magnitudes. Over time, we've witnessed the growth of what could be described as best practices in terms of how to ...]]>In recent years we've seen several companies suffer from hacks of various magnitudes. Over time, we've witnessed the growth of what could be described as best practices in terms of how to respond.

The typical arc goes something like this:

The hack is discovered. Immediately thereafter, the company discloses the pertinent details about the hack, including the number of users impacted, and specifics on what data was compromised. They apologize, tighten up their processes, and often pay for a year (or more) of free credit monitoring for users who were affected by the breach.

All they while, they're working with law enforcement to get to the bottom of who hacked them in order to bring the perpetrators to justice. That's not the path Uber chose to take when they were hacked two years ago.

Instead, when the hackers contacted Uber and demanded $100,000 to reveal how they compromised Uber's system, the company quietly paid up, and said the payment was a very large bug bounty. A year later, the company informed the users who had their data compromised.

Needless to say, that's fairly far removed from the established best practices. When the details came to light, the EU took action.

Recently, the UK's ICO (Information Commissioner's Office) and its data protection authority in the Netherlands both announced a decision to fine Uber for the disclosure delay. The UK fine amounted to £385,000 and the fine from the Netherlands amounted to €600.000.

In all, the breach impacted some 2.7 million users in the UK and nearly 200,000 in the Netherlands.

A spokesman from the Information Commissioner's Office had this to say about the matter: "The incident, a serious breach of principle seven of the Data Protection Act 1998 had the potential to expose the customers and drivers affected to increased risk of fraud."

Ultimately, the fines amount to little more than a slap on the wrist. Uber got off easy in that regard, but hopefully, the slap was hard enough that should another such incident occur, they'll choose to handle it very differently.

]]>https://www.securefuturetech.com/2018/12/11/uber-gets-hefty-fine-from-the-eu-for-data-breach/feed/0Hackers Target Users Of Google Maps With Bank Phone Scamhttps://www.securefuturetech.com/2018/12/10/hackers-target-users-of-google-maps-with-bank-phone-scam/
https://www.securefuturetech.com/2018/12/10/hackers-target-users-of-google-maps-with-bank-phone-scam/#respondMon, 10 Dec 2018 16:00:00 +0000https://www.securefuturetech.com/2018/12/10/hackers-target-users-of-google-maps-with-bank-phone-scam/Google relies on crowd sourcing to help keep its maps up to date. There's no other approach that even comes close to being feasible. Sure, Google has employees on the job, roving ...]]>Google relies on crowd sourcing to help keep its maps up to date. There's no other approach that even comes close to being feasible. Sure, Google has employees on the job, roving the nation's highways, byways, and back streets. Even if the company employed ten times the number they're currently using, their maps wouldn't be nearly as accurate as they've become via crowd sourcing.

Unfortunately, there's a flaw in the system, and that flaw has been exploited in recent months by clever scammers.

Here's how it works: One of the things users can do is log in and edit maps, including the addresses and phone numbers associated with businesses like, say...banks. The scammers will change the phone number of a bank as it appears on maps, using a number that they control, with a smooth-talking con artist on the other end of the line.

If a user is browsing maps looking for resources (restaurants, banks, etc.) which happens frequently when people are traveling, they'll see the number helpfully listed on the map entry and call. They'll be thinking they're talking to a bank representative, who will, over the course of the conversation, ask them for their name, address, phone number, PIN, bank account number, etc.

It all sounds very legitimate and straightforward, except of course that bank employees don't actually ask for your PIN or account number.

Of course, once the scammer has what they need, the call will be disconnected in the process of "transferring" the caller to some other department, and the damage is done.

Google does mention the fact that banks and other legitimate services tend to keep requests for personal information to an absolute minimum, and that when contacting any business, it's always best to get their contact information straight from the company's website, rather than relying on the information found on maps, but sadly, that message isn't getting through in at least some cases.

Word to the wise, don't rely on the contact information you see on Google Maps. Go straight to the source.

]]>https://www.securefuturetech.com/2018/12/10/hackers-target-users-of-google-maps-with-bank-phone-scam/feed/0Update Patch From Microsoft Causing Issues With Outlook Usershttps://www.securefuturetech.com/2018/12/08/update-patch-from-microsoft-causing-issues-with-outlook-users/
https://www.securefuturetech.com/2018/12/08/update-patch-from-microsoft-causing-issues-with-outlook-users/#respondSat, 08 Dec 2018 16:00:00 +0000https://www.securefuturetech.com/2018/12/08/update-patch-from-microsoft-causing-issues-with-outlook-users/Back in October, Microsoft issued an update for Windows 10 that was a bit of a disaster. It wound up deleting some user files and sparked a completely justified outrage. The company ...]]>Back in October, Microsoft issued an update for Windows 10 that was a bit of a disaster. It wound up deleting some user files and sparked a completely justified outrage. The company pulled the update back, taking it offline so more people wouldn't be impacted. Then they recently re-released it, this time, without the file deletions.

Unfortunately, that wasn't the first time the company had stumbled where updates were concerned. In fact, many of Microsoft's recent patches and updates have been problematic. The company has promised to make changes in the way they're doing things and to be more transparent about their processes.

They've taken a few preliminary steps in that direction. It hasn't seemed to help, at least not based on their rollout of a recent patch designed to "fix" Outlook 2010.

The November 13 security update, Kb4461529 addressed several flaws and vulnerabilities. In one instance, however, the company addressed a security flaw which would allow a hacker to remotely execute code via a specially crafted Word document. The company's "fix" to protect Outlook 2010 users was to simply disable the program entirely.

Needless to say, Outlook 2010 users were not amused. To make matters worse, Microsoft advised users not to uninstall the patch, but rather, to wait for the next patch (released on November 21st). That patch, KB4461585, the company promised would fix the crashing issue.

Sure enough, the second patch worked as advertised, but sadly, people who took Microsoft's advice were without their email for two weeks and that's simply unacceptable.

All companies stumble. All companies make mistakes. That's inevitable. Unfortunately, Microsoft can't seem to stay out of its own way where patches and security updates are concerned. The last several months have been a parade of blunders. Here's hoping the company can identify the flaw in its process sooner, rather than later. For all our sakes.

]]>https://www.securefuturetech.com/2018/12/08/update-patch-from-microsoft-causing-issues-with-outlook-users/feed/0Amazon Accidentally Leaked Customer Names And Email Addresseshttps://www.securefuturetech.com/2018/12/07/amazon-accidentally-leaked-customer-names-and-email-addresses/
https://www.securefuturetech.com/2018/12/07/amazon-accidentally-leaked-customer-names-and-email-addresses/#respondFri, 07 Dec 2018 16:00:00 +0000https://www.securefuturetech.com/2018/12/07/amazon-accidentally-leaked-customer-names-and-email-addresses/There's trouble brewing at Amazon, although details are sketchy about how much trouble there might be. Recently, the company sent the following message to some of its customers: "Hello, We're contacting you ...]]>There's trouble brewing at Amazon, although details are sketchy about how much trouble there might be.

Recently, the company sent the following message to some of its customers:

"Hello, We're contacting you to let you know that our website inadvertently disclosed your email address due to a technical error. The issue has been fixed. This is not a result of anything you have done, and there's no need for you to change your password or take any other action."

That's it. At this point, that's all the information the company has released about the matter, and we'd love to know more.

How many users were impacted? Unfortunately, the only way to know if your email address was exposed is if you received the email we referenced above.

What caused the technical error? How likely is it to occur again? What steps were taken to ensure that it won't occur again? Was the "technical error" in any way related to the actions of a third party, or was it entirely an internal issue? Either way, what exactly was the issue?

Public companies owe the public an explanation, and in cases like these, more information and full disclosure is always better than silence. Amazon has been in the game long enough to know this, which is why we find their silence about the matter to be an even mix of frustrating, disappointing and infuriating.

The bottom line is: Something happened. User email addresses were exposed, and although repeated attempts have been made to pry more information out of Amazon, no further details have been forthcoming. File this one away under 'How Not to Handle An Issue Like This At Your Company.'

We understand that Amazon is likely very busy due to the Holiday Shopping season, but honestly, we expected more from one of the biggest sites on the internet.